Certificate Fails to create when associated to a Key Vault #3732
Labels
awaiting-feedback
Blocked on input from the author
kind/bug
Some behavior is incorrect or out of spec
Comments
TomMakes
added
kind/bug
|
Hi @TomMakes sorry you're having some challenges with this resource. I've done a little digging myself and can't see anything obviously wrong with your setup. I've not been able to run the sample code as it depends on a few external pieces to be implemented (env, consts and the actual cert binary). If the creation via the CLI is working, I'd suggest using that to export an ARM template and inspect how that is structured. This might give an indication as to the values the Azure service is happy with. Another option to try out is using a different version of the resource. These are located as sub-packages within the azure-native SDK e.g. |
danielrbradley
added
awaiting-feedback
|
Hi @danielrbradley I looked at the ARM template, and it doesn't look too useful. I tried using v20240401_native_web and it gave me the same error, so sadly that didn't fix anything. Here is the ARM template output {
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vaults_test_key_vault_3_name": {
"defaultValue": "test-key-vault-3",
"type": "String"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.KeyVault/vaults",
"apiVersion": "2024-04-01-preview",
"name": "[parameters('vaults_test_key_vault_3_name')]",
"location": "centralus",
"properties": {
"sku": {
"family": "A",
"name": "standard"
},
"tenantId": "35a7d303-0fa8-4387-a3ba-9416897264e1",
"accessPolicies": [
{
"tenantId": "35a7d303-0fa8-4387-a3ba-9416897264e1",
"objectId": "958d1200-4a93-4cfd-8019-b61847252a9b",
"permissions": {
"certificates": [
"get",
"list",
"delete",
"create",
"import",
"update",
"getissuers",
"listissuers",
"recover",
"purge",
"backup",
"restore"
],
"keys": [
"get",
"list",
"update",
"create",
"delete",
"purge"
],
"secrets": [
"get",
"list",
"set",
"delete",
"backup",
"restore",
"recover",
"purge"
]
}
}
],
"enabledForDeployment": true,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": true,
"enableSoftDelete": false,
"softDeleteRetentionInDays": 90,
"enableRbacAuthorization": false,
"vaultUri": "[concat('https://', parameters('vaults_test_key_vault_3_name'), '.vault.azure.net/')]",
"provisioningState": "Succeeded",
"publicNetworkAccess": "Enabled"
}
},
{
"type": "Microsoft.KeyVault/vaults/keys",
"apiVersion": "2024-04-01-preview",
"name": "[concat(parameters('vaults_test_key_vault_3_name'), '/test-cert-2')]",
"location": "centralus",
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', parameters('vaults_test_key_vault_3_name'))]"
],
"properties": {
"attributes": {
"enabled": true,
"nbf": 1733255158,
"exp": 2048615158
}
}
},
{
"type": "Microsoft.KeyVault/vaults/secrets",
"apiVersion": "2024-04-01-preview",
"name": "[concat(parameters('vaults_test_key_vault_3_name'), '/test-cert-2')]",
"location": "centralus",
"dependsOn": [
"[resourceId('Microsoft.KeyVault/vaults', parameters('vaults_test_key_vault_3_name'))]"
],
"properties": {
"contentType": "application/x-pkcs12",
"attributes": {
"enabled": true,
"nbf": 1733255158,
"exp": 2048615158
}
}
}
]
} |
pulumi-bot
added
needs-triage
|
Hi @TomMakes, could it be missing permissions to the Vault? The docs here say
and I don't see such an access policy for your Vault. Although, admittedly, the "invalid value" error would be strange in this cause. If that still doesn't help, could you run |
thomas11
added
awaiting-feedback
|
Hi @thomas11, I've been poking around these past few days and tried a few things:
|
pulumi-bot
added
needs-triage
|
Thank you for the log. We can see that the KV id is Unfortunately, it's hard for me to tell what Azure finds wrong here given the unhelpful error message. However, looking around the web a bit, I get the impression that the Microsoft.Web/certificates API is only intended to add existing certificates to a web app. I.e., add the cert with the given |
thomas11
added
awaiting-feedback
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What happened?
I am trying to create a key vault and certificate in an existing resource group.
The key vault is able to be created, but the certificate fails with an error,
error: autorest/azure: Service returned an error. Status=400 Code="BadRequest" Message="The parameter Properties.KeyVaultId has an invalid value." Details=[{"Message":"The parameter Properties.KeyVaultId has an invalid value."},{"Code":"BadRequest"},{"ErrorEntity":{"Code":"BadRequest","ExtendedCode":"51008","Message":"The parameter Properties.KeyVaultId has an invalid value.","MessageTemplate":"The parameter {0} has an invalid value.","Parameters":["Properties.KeyVaultId"]}}]Things I've tried:
Example
Cert creation script
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 3650 -nodes -subj "/C=US/ST=MA/L=Boston/O=TestOrg/OU=devops/CN=demo.test.io" openssl pkcs12 -export -in cert.pem -inkey key.pem -out test-cert-2.pfxPulumi file
Output of
pulumi aboutCLI
Version 3.134.1
Go Version go1.23.1
Go Compiler gc
Plugins
KIND NAME VERSION
resource azure 6.0.0
resource azure-native 2.65.1
resource azuread 5.53.4
language nodejs unknown
resource random 4.13.2
Host
OS Microsoft Windows 11 Pro
Version 10.0.22631 Build 22631
Arch x86_64
This project is written in nodejs: executable='C:\Program Files\nodejs\node.exe' version='v18.10.0'
Additional context
No response
Contributing
Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).
The text was updated successfully, but these errors were encountered: